EUVD-2024-37507

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion...

CVE-2024-36136

An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS...

CVE-2024-38653

CVE-2024-38653 (Ivanti Avalanche 6.3.1, SmartDeviceServer) exposes an XML External Entity (XXE) flaw that allows a remote unauthenticated attacker to read arbitrary files on the server. Root cause: XXE in SmartDeviceServer. Impact: confidential data exposure; no integrity/availability impact expl...

CVE-2024-37399

Ivanti Avalanche

PT-2024-27504 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.1 Description: The issue is related to improper input validation in the Central Filestore, allowing a remote authenticated attacker with admin rights to achieve remote code execution RCE. This is due to an...

PT-2024-26915 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.1 Description: The issue is caused by an off-by-one error in the WLInfoRailService, allowing a remote unauthenticated attacker to crash the service, resulting in a denial of service. Additionally, improper input...

Security Advisory Ivanti Avalanche 6.4.4 (CVE-2024-38652, CVE-2024-38653, CVE-2024-36136, CVE-2024-37399, CVE-2024-37373)

Ivanti has released updates for Ivanti Avalanche, in version 6.4.4, which addresses high severity vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score Severity | CVSS...

Ivanti Releases Security Updates for Avalanche, Neurons for ITSM, and Virtual Traffic Manager

Ivanti released security updates to address multiple vulnerabilities in Ivanti Avalanche, Neurons for ITSM, and Virtual Traffic Manager vTM. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Ivanti advises users to reduce their attack surface...

PT-2024-8675 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.1 Description: The issue is related to an XML External Entity XXE flaw in the SmartDeviceServer component of Ivanti Avalanche. This flaw allows a remote unauthenticated attacker to read arbitrary files on the...

PT-2024-8681

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 6.3.1 Description A NULL pointer dereference exists in the WLAvalancheService component of Ivanti Avalanche. This issue allows a remote, unauthenticated attacker to cause a denial-of-service DoS condition by crashing...

Malicious code in avalanche_compass_scoped (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in avalanche_compass_scope (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1784 Malicious code in avalanche_compass_scope (npm)

--- -= Per source details. Do not edit below this line.=-...

The vulnerability of the FileStoreConfig application in the Avalanche mobile device management system allows a hacker to execute arbitrary code.

The vulnerability of the FileStoreConfig application in the Avalanche mobile device management system involves unlimited loading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially created file...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.x. The vulnerability stems from the...

Ivanti Avalanche FileStoreConfig Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig app. The issue results from the lack of proper validation of...